CVE-2026-82251

gitoxide before 0.52.1 does not validate submodule names taken from a repository's .gitmodules configuration, allowing path traversal (CWE-22) when the library derives the submodule's git directory. The flaw is triggered when an application using gitoxide processes a crafted repository whose .gitmodules contains a submodule name with traversal segments, causing the state() and open() functions to resolve to repositories outside the intended .git/modules directory. An attacker gains repository confusion: gitoxide operations may target repositories outside the expected location, including inspection of attacker-controlled repositories, and the CVSS 4.0 score of 8.7 (high) reflects high confidentiality impact with no integrity or availability loss. Anyone running applications, services, or tooling built on gitoxide versions before 0.52.1 that open or inspect untrusted repositories containing submodules is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.4% chance of exploitation in the next 30 days.

What to do: Upgrade gitoxide/gix to version 0.52.1 or later. Until patched, avoid using gix to open or inspect untrusted repositories containing submodules, or pre-screen .gitmodules entries and reject submodule names containing traversal segments such as '..' or path separators. Audit your Rust dependency tree for gix/gix-* crates older than 0.52.1, as the library is typically pulled in transitively.